Hide Space from Specific User

How can I hide a space from a specific user who is a member of a group to which has read access?

Is my only option to move the user from read-access group to forbidden-group which lacks access to my space? I looked and confluence permissions/restrictions all appear to be additive and I have a...subtractive... use case.